External risk intelligence

LibreNMS LDAP Filter Injection Authentication Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-109357

LibreNMS is a network monitoring system typically deployed as a web application. The vulnerability affects the authentication process for web-based access. Given its role as a management and monitoring platform, these systems are commonly exposed as web services to facilitate monitoring across networks, making the web interface a likely internet-facing or externally reachable service in many deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in LibreNMS could allow unauthorized individuals to gain administrative access by manipulating user authentication. It affects how the system handles usernames during user directory lookups, potentially bypassing security checks. The main concern is confirming relevance and exposure within your environment.

Unsanitized usernames enable unauthorized admin access.
Protects core monitoring system from compromise.
Assess if your monitoring system is affected.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit this vulnerability by sending a crafted username in the HTTP Basic Authorization header to bypass authentication and gain administrative access. This occurs when the application is configured to use LDAP for user authorization and the `REMOTE_USER` variable is not properly forwarded. The attacker starts with no credentials but requires the application to be accessible over the network.

Network exposure required for access.
Unescaped username in LDAP search filter.
Unauthorized administrative control.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory's context, unauthenticated attackers could leverage an LDAP filter injection vulnerability in authorization modes to bypass authentication and gain administrative access to LibreNMS. This occurs when usernames are not properly escaped, allowing wildcard characters to match all users and groups, particularly when specific configuration conditions are met.

Admin access to LibreNMS.
Unescaped username via authorization header.
Complete system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

The LibreNMS platform, a network monitoring tool, has a critical vulnerability that could allow unauthenticated attackers to gain administrative access. This issue affects the LDAP and Active Directory authorization modes when specific conditions are met, enabling attackers to bypass authentication by manipulating usernames. The first practical move is to identify all LibreNMS instances, determine their exposure and business criticality, and locate the accountable owners for remediation.

Platform or Application Owners.
Confirm external reachability and impact.
Plan and execute remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is LibreNMS?

LibreNMS is an open-source, auto-discovering network monitoring system built on PHP, MySQL, and SNMP. IT teams use it to track the health, performance, and availability of network hardware, servers, and connected devices across an organization. It provides a web-based dashboard that centralizes data, making it a critical tool for infrastructure management.

How does CVE-2026-109357 work?

This vulnerability is an LDAP filter injection, categorized as CWE-90. It occurs because LibreNMS fails to sanitize usernames before inserting them into LDAP or Active Directory search queries. By injecting specific characters into a login field, an attacker can manipulate the search logic to trick the system into authenticating them, even without a valid password.

Do I need valid credentials to trigger this bug?

No. An unauthenticated attacker can exploit this by submitting a crafted username via an HTTP Basic Authorization header. This attack specifically relies on the application being configured for LDAP or AD authorization while failing to use a forwarded REMOTE_USER variable. If your system is not configured for these LDAP modes, or if it correctly handles variable forwarding, this specific trigger path is not applicable.

Is my LibreNMS instance at high risk?

According to Halo Surface Signal, this risk is higher if your web interface is internet-facing. Because LibreNMS is a management platform, it is often exposed to allow administrators to monitor networks remotely. If your instance is reachable over the network rather than restricted to an internal-only environment, the potential for an external attacker to reach the vulnerable authentication endpoint is significantly increased.

When should I prioritize patching this?

You should prioritize this as soon as possible if you use LDAP or Active Directory for authentication. Start by auditing your LibreNMS inventory to confirm if your specific deployment uses these authorization modes. Once identified, consult the vendor's guidance to update to version 26.9.0 or later, which resolves the injection weakness.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.